Ask HN: Why hasn't x86 caught up with Apple M series?
421 points by stephenheron 2d ago 604 comments
Ask HN: Best codebases to study to learn software design?
100 points by pixelworm 3d ago 89 comments
Beginning 1 September, we will need to geoblock Mississippi IPs
159 AndrewDucker 186 8/27/2025, 8:03:01 PM dw-news.dreamwidth.org ↗
I appreciate that not all modern post 1776 democracies are the same, but in Australia, whose constitution was informed hugely by the US constitution, Federal communications law takes supremacy over states, and states laws cannot constrain trade between the states. There are exceptions, but you'd be in court. "trade" includes communications.
So ultimately, isn't this heading to the FCC, and a state-vs-federal law consideration?
-Not that it means a good outcome. With the current supreme court, who knows?
In his concurring opinion, Justice Kavanaugh said it was likely unconstitutional (but apparently not obviously enough to enjoin it) [1]. So it's going into effect, then the lawsuit follows.
Similar laws in California, Arkansas and Ohio were all found unconstitutional, so I am hopeful. That said, these were all district court decisions, and all of them are being appealed. When they lose on appeal, they go to the Supreme Court for (hopefully) the final smack-down.
Interestingly, reading the summary MS HB1126 [2], this law is doing two things. It regulates companies and defines crimes.
States are allowed to set their own criminal codes. If Mississippi drops the mandate part and passes a new law that simply defines certain things as crimes with corresponding penalties, that law would probably be constitutional.
[1] https://www.supremecourt.gov/opinions/24pdf/25a97_5h25.pdf
[2] https://legiscan.com/MS/bill/HB1126/2024
We've let states set their own "internet services" taxes, making selling anything online in the US a regulatory nightmare. A third-party vendor to manage (and keep up with) the tax laws to stay compliant is basically required for anyone selling online, or risk the wrath of various state tax bodies.
Launch a small website and commit a felony in 7 states and 13 countries.
I wouldn't have known about the Mississippi bill unless I'd read this. How are we have to know?
If anything, communications between Mississippi and California would be interstate commerce and would thus fall under federal legal jurisdiction.
If I run a server in Utah primarily for myself, and you as a Californian happen to stumble upon it, should I have to abide by California privacy laws?
>A blog is speech, but I wouldn't say that deciding to operate a social media site is speech.
______
* See UDHR articles 12, 18, 19, and 20. This is not an issue limited to the laws of one small country.
† Unless the site operators also use of the site, in which case they too do suffer it; this is in my experience virtually always the case with the noncommercial sites that it is most important to protect.
I suppose this is what confused me then, as it seemed obvious that e.g. the Facebook reccomendation algorithm isn't speech, so if a social media site would be considered speech it would be due to the user content. Section 230 doesn't in any way supercede the constitution, but it does clarify which party is doing the speech and thus where the first ammendment would apply.
* The First Amendment generally prohibits the government from enacting any laws or regulations that limit speech based on its content (anything you might reasonably call "moderation" would definitely fall into this category!).
* Private companies are not the government. Social media networks are therefore not obligated to follow the First Amendment. (Although there is a decent argument that Trump's social media network is a state actor here and is therefore constitutionally unable to, say, ban anybody from the network.)
* Recommendation algorithms of social media networks are protected speech of those companies. The government cannot generally enact a law that regulate these algorithms, and several courts have already struck down laws that attempted to do so.
* §230 means that user-generated speech is not treated as speech of these companies. This prevents you from winning a suit against them for hosting speech you think injures you (think things like defamation).
* §230 also eliminates the liability of these companies for their moderation or lack thereof.
There remains the interesting question as to whether or not companies can be held liable via their own speech that occurs as a result of the recommendation algorithms of user-generated content. This is somewhat difficult to see litigated because it seems everybody who tries to do a challenge case here instead tries to argue that §230 in its entirety is somehow wrong, and the court rather bluntly telling them that they're only interested in the narrow question doesn't seem to be able to get them to change tactics. (See e.g. the recent SCOTUS case which was thrown out essentially for this reason rather than deciding the question).
No, it immunizes certain parties from being held automatically liable (without separate proof that they knew of the content, as applies to mere distributors [0]), the "publisher or speaker" standard being the standard for such liability (known as publisher liability.)
It doesn't "clarify" (or have any bearing on) where the First Amendment would apply. (In fact, its only relevant when the First Amendment protection doesn't apply, since otherwise there would be no liability to address.)
[0] subsequent case law has also held that Section 230 has the effect of also insulating the parties it covers against distributor liability where that would otherwise apply, as well, but the language of the law was deliberately targeted at the basis for publisher liability.
People who are not “the speaker or publisher” for liability purposes have Constitutional first amendment free speech rights in their decision to interact with content, this includes distributors, consumers, people who otherwise have all the characteristics of a “speaker of publisher” but are statutorily relieved of liability as one so as to enable them to make certain editorial decisions over use generated content without instantly becoming fully liable for every bit of that content, etc., yeah.
And arguing the alternative is you making the exact inversion of statute and Constitution I predicted and which you denied, that is, thinking Section 230 could remove First Amendment coverage from something it would have covered without that enactment.
Websites don't have to be a business or be related to one.
But yeah, this definitely sounds like a business opportunity for services or hosts.
Regulatory capture in real time!
What would you have preferred? Of course you'd prefer if the law never existed in the first place, but I don't see having a third party auditor verify compliance is any worse than say, letting the government audit it. We don't think it's "regulatory capture" to let private firms audit companies' books, for instance.
it's regulatory capture if a cartel of ID verification companies are lobbying for specific requirements that lock out upstart competitors.
Same goes for other countries as well. It’s insane.
Welcome back to the 90s and the PGP, Clipper chip, warez, and DeCSS days.
At some point, they will have outlawed enough things that most people want, that most people will become outlaws.
The US doesn’t have 50 different cultures with totally different values, but probably has like… 7.
Yes! Make a union of states! How should we call that? States Union... Union of States... United States! Yeah, that should work.
I think it's going to happen one way or another and the most peaceful way to do it would be sooner rather than later.
At some point it makes more sense to pass such a law at the federal level since we end up there eventually either way.
Expecting laws to instead propagate from neighbor to neighbor as I accidentally suggested—this wasn’t what I meant to suggest, but in defense of the idea:
> At some point it makes more sense to pass such a law at the federal level since we end up there eventually either way.
I do think there still could be some value. Laws could propagate across states that are more receptive to them, and then people can see if they work or not. Porting Masshealth to the whole country at once seems to have been a little bumpy. If it has instead been rolled out to the rest of New England, NY, then down to Pennsylvania… might have gone a little smoother.
Indeed. It has far more than that. The US is astonishingly diverse.
Source: am from Kansas City.
Source: am from St. Louis.
I.E. Are US ISPs, particularly big ones like Comcast, required to geolocate ISPs to the state where the person is actually in? What about mobile ones?
Where I live (not US), it is extremely common to get an IP that Maxmind geolocates to a region far from where you actually live.
As you say, IP geolocation is unreliable. Unfortunately that's the only option. If it is technologically impossible to comply with the law, you just gotta do the best you can. If someone in MI gets a weird IP, there's absolutely nothing any third party can do. That's on the ISP for not allocating an appropriate IP or the legislators for being morons.
The law in question requires "commercially reasonable efforts"
Personally I'd say none at all, unless the government itself provides it as a free service, takes on all the liability, and makes it simple to use.
It also defines personally identifiable information as including "pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual." But it doesn't specify what it means by 'controller' or 'processor' either.
If a hobbyist just sets up a forum site, with no payment processor and no identified or identifiable information required, it would seem reasonable that the law should not apply. But I'm not a lawyer.
Clearly, however, attempting to comply with the law just in case, by requiring ID, would however then make it applicable, since that is personally identifiable information.
The free tier does have limits on the number of API calls can you can make. But the good news is you don't have to use their API. You can download the database [1] and do all the lookups locally without having to worry about going over their API limits.
It consists of 10 CSV files and is about 45 MB compressed, 380 MB uncompressed. For just identifying US states from IP address you just need 3 of the CSV files: a 207 MB file of IPv4 address information, a 120 MB file for IPv6, and a 6.7 MB file that lets you lookup by an ID that you find in one of the first two the information about the IP address location including state.
It's easy to write a script to turn this into an SQL database that just contains IP ranges and the corresponding state and then use that with sqlite or whatever network database you use internally from any of your stuff that needs this information.
If you don't actually need Geo IP in general and are only adding it in order to block specific states you can easily omit IPs that are not mapped to those states which would make it pretty small. The database has 3.4 million IPv4 address ranges, but only 5 359 of them are listed as being in Mississippi. There are 1.8 million address ranges in the IPv6 file, and 3 946 of them are listed as being in Mississippi.
Here's how to get the Mississippi ranges from the command line, although this is kind of slow--the 3rd line took 7.5 minutes on my M2 Mac Studio and the 4th took almost 4 minutes. A proper script or program would be a lot faster.
Also a proper script or program would be able to look specifically at the correct field when matching the ID from the locations file to the IP range lines. The commands above just hope that things that look like location IDs don't occur in other fields in the IP range files.Also there is no need to spend time parsing it yourself, there are plenty of existing libraries you can simply point at the file.
Calling geoip databases "surveillance capitalism" seems like a stretch. It might be used by "surveillance capitalism", but you don't really have to surveil people to build a geoip database, only scrape RIR allocation records (all public, btw) and BGP routes, do ping tests, and parse geofeeds provided by providers. None of that is "surveillance capitalism" in any meaningful sense.
So if someone is making money off of it it's suddenly "surveillance capitalism"? What makes it more or less "surveillance capitalism" compared to aws selling cloudfront to some ad company?
Moreover you can do better than area level code granularity. When landlines were more common and local number portability wasn't really a thing, can look at the CO number (second group) to figure out which town or neighborhood a phone number was from. Even if this was all information you could theoretically determine yourself, I'm sure there are companies that package up the data in a nice database for companies to use. In that case is that "surveillance capitalism"? Where's the "surveillance" aspect? It's not like you need to stalk anyone to figure out where a CO is located. That was just a property of the phone network.
>GeoIP databases are much higher resolution and use active scanning methods like ping timing. If a company was spam calling me to estimate distance based on call connection lag, yes that would be surveillance capitalism.
Why is the fact it's "active" or not a relevant factor in determining whether it's "surveillance capitalism" or not? Moreover spam calling people might be bad for other reasons, but it's not exactly "surveillance".
Setting aside the problem with pinging home IPs (most home routers have ICMP echo requests disabled), your definition of "systematic observation" seems very flimsy. Is monitoring the global BGP routing table "systematic observation"? What about scraping RIR records? How is sending ICMP echo requests and observing the response times meaningfully similar to what google et al are doing? I doubt many people are upset about google "systematically observing"... the contents of books (for google books), or the layout of cities (for google maps, ignoring streetview). They're upset about google building dossiers on people. Observing the locations of groups of IP addresses (I'm not aware of any geoip products that can deanonymize specific IP addresses) seems very divorced from that, such that any attempts at equating the two because "systematic observation" is non-nonsensical.
> They're upset about google building dossiers on people.
Their location being in that dossier is part of what upsets people.
Except I'm not aware of any geoip databases that operate on a per-IP level. It's way too noisy, given that basically everyone uses dynamic IP addresses. At best you can figure out a given /24 is used by a given ISP to cover a certain neighborhood, not that 1.2.3.4 belongs is John Smith or 742 Evergreen Terrace.
I run a geolocation service, and over the years we've seen more and more ISPs providing official geofeeds. The majority of medium-large ISPs in the US now provide a geofeed, for example. But there's still an ongoing problem in geofeeds being up-to-date, and users being assigned to a correct 'pool' etc.
Mobile IPs are similar but are still certainly the most difficult (relative lack of geofeeds or other accurate data across providers)
https://news.ycombinator.com/item?id=44990886 ("Bluesky Goes Dark in Mississippi over Age Verification Law (wired.com)"—175 comments)
https://en.wikipedia.org/wiki/Dreamwidth
https://en.wikipedia.org/wiki/The_Walker_Montgomery_Protecti...
I was totally ready to consider blocking US IP ranges too, if there was a good reason. I run a small business and 0% of my customers are overseas.
The threat of lawsuits.
> How is this enforceable if a company doesn't have any infrastructure within that state?
If you are intentionally doing business in a US state, and either you or your assets are within the reach of courts in the US, you can probably be sued under the state's laws, either in the state's courts or in federal courts, and there is a reasonable chance that if the law is valid at all, it will be applied to your provision of your service to people in that state. Likewise, you have a risk from criminal laws of the state if you are personally within reach of any US law enforcement, through intrastate extradition (which, while there is occasional high-profile resistance, is generally Constitutionally mandatory and can be compelled by the federal courts.)
That's why services taking reasonable steps to cut off customers accessing their service from the states whose laws they don't want to deal with is a common response.
It would be pretty crazy if you could kill someone in Arizona and then just walk over the border to California and not be able to be prosecuted…
https://en.wikipedia.org/wiki/Zone_of_Death_(Yellowstone)
"The Zone of Death is the 50-square-mile (130 km2) area in the Idaho section of Yellowstone National Park in which, as a result of the Vicinage Clause in the Constitution of the United States, a person may be able to theoretically avoid conviction for any major crime, up to and including murder"
>New York governor rejects Louisiana's extradition request for doctor in abortion pill case
cough
I mean it would be absurd if an anti-death-sentence state started trying to extradite the executioners working in pro-death-sentence states for murder, right?
Not by the same definition, no, its not, though there is a crime called "murder" in all states, and there tends to be significant overlap in the definitions.
To enforce all this, states can sue companies and they can take steps to ensure companies can't do business in their state (so like maybe force ISPs to block Dreamwidth?).
(It is possible for state charges existing to make other actions federal crimes, though, e.g., there is a federal crime of interstate travel to avoid prosecution, service of process, or appearance as a witness. But state charges themselves can't get "bumped up" to the federal level.)
There is a certain group in the USA that is working hard on undermining the rights of the people of America, the enemies, foreign and domestic, per se; and this is part of their plank to control speech through fear and total control and evisceration of anonymity.
I support controlling access to porn for children, especially since I know people who were harmed and groomed by it, but these types of laws are really just the typical liar’s wedge to get the poison pill of tracking and suppression in the door.
I hope some of the court cases can fix some of these treasonous and enemy acts by enemies within, but reality is that likely at the very least some aspects of these control mechanisms will remain intact.
If it really was about preventing harm against children, then they would have prevented children from accessing things, not adults. But that’s how you know it’s a perfidious lie.
This MS situation is just another step towards what they really want, total control over speech, thought, and what you are able to see and read.
This MS situation is just a kind of trial balloon, a probe of the American people and the Constitution and this thing we still call America even though enemies are within our walls dismantling everything.
As you may have read, in MS they are trying to require all social media companies to “…deanonymize and age-verify all users…” …… to protect the children, of course. So you, an adult, have to identify yourself online in the public square that is already censored and controlled and mapped, to the government so it can, e.g., see if you oppose or share information about the genocide it is supporting … to protect Mississippi children, of course.
It's a good question. Maybe something with interstate commerce laws?
That loophole got closed once inter-state data sharing became possible and Oregon merchants were required to start collecting those out-of-state taxes at the point of sale.
Oregon merchants are not required to collect sales tax for any other jurisdictions outside of Oregon. And they don’t, any non Oregonian can go to any merchant in Oregon right now, and you will be charged the same as any other customer who lives in Oregon.
Also, it was never a loophole to buy things in Oregon to evade sales tax. All states with sales tax require their residents to remit use tax for any items brought into the state to make up the difference for any sales tax that would have been paid had it been purchased in their home state.
Avoiding taxes. It's different. It was always perfectly legal to travel to another state to buy something expensive and bring it back home. No crimes were committed.
It was a loophole that you could buy in Oregon specifically to avoid $1,000s in sales taxes.
It was legal to do that. If it was purchased out of state with the intent of bringing it back home, then (assuming the home state was California) California use taxes were always owed on it. Other states with sales taxes also tend to have similarly-structured use taxes with rates similar to the sales tax rates.
They were legally avoiding sales taxes, but also illegally evading use taxes, and, moreover, there is very little reason for the former if you aren't also doing the latter, unless you just have some moral objection to your taxes being taken at the point of sale and the paperwork and remittance to the government being done by the retailer instead of being a burden you deal with yourself.
AFAIK it's not that Oregon changed anything, either. It's that Washington passed additional laws that require out-of-state merchants to collect the tax when selling to customers in WA, and said out-of-state merchants complied.
The situation petcat described is tax evasion (illegal, since use tax is due in lieu of paying sales tax at point of purchase, assuming item is brought back to home state).
Tax avoidance is simply minimizing tax liability, completely legal.
It’s called a ‘use tax’. In practice, nobody pays (personal) use tax, myself included.
Washington has a use tax: https://dor.wa.gov/taxes-rates/use-tax
California has a use tax: https://cdtfa.ca.gov/taxes-and-fees/use-tax/
Idaho has a use tax: https://tax.idaho.gov/taxes/sales-use/use-tax/online-guide/
So, all of those people going to Oregon to shop without sales tax and not paying use tax were technically breaking the law, not using a loophole. I’m not judging them, I don’t pay use tax either :)
I’ve never understood people like you that say anything and everything to increase taxes.
How does it make any rational or logical sense that you should pay higher taxes for something?
So when you go to Delaware that has 0% sales taxes, you make sure to log everything and pay taxes to your home state upon return?
If you don't, you are technically violating the law. All states with sales tax also have a use tax.
For example, if you are a resident of neighboring Maryland, this is the form you'd need to fill out for purchases you make in Delaware.
https://www.marylandcomptroller.gov/content/dam/mdcomp/tax/f...
Most areas of governance usually give years of preparation ahead of anything actually being enforced. This is so short-sighted.
Might as well be the slogan of the current era
But the law was signed over a year ago[1]? The recent development was that the injunction blocking the bill from being implemented got struck down. I'm not sure what you'd expected here, that the courts delay lifting the injunction because of the sites that didn't bother complying with the law, because they thought they'd prevail in court?
[1] https://legiscan.com/MS/bill/HB1126/2024
If they make an honest attempt to comply and a small number of people using VPNs slip through the cracks, if they're ever reported, they'll likely be given a slap on the wrist at most. If they ignore the law or do some obvious half assed attempt to comply and thousands of Mississippi users are still using their site and they get reported, it's far less likely that a judge will be lenient.
The end game here is total control and awareness of who is saying what at any time, in order to allow those messages to be thwarted.
> However, it doesn't apply to news sources, online games or the content that is be made is by the service itself or is an application website.
What is an "application website"? I can't seem to find how they're defining that.
My understanding is that this is similar to the law the UK passed recently except instead of verifying age of users for "adult" content, every platform needs to verify (and log) age of all users for all content?
It can't possibly be that ridiculous.
https://law.justia.com/codes/mississippi/title-45/chapter-38...
That's probably what the wikipedia author meant to say
does that also mean that all social media platforms will start a small jobs board?
Putting a small jobs board on instagram would not make instagram "primarily function" as a job application website. LinkedIn is primarily a professional networking website - it qualifies.
Google have additional information about IP addresses that updates dynamically based on cell phone, wifi and other magic usage so maybe ask them if they have some javascript that queries their site for more specific city/state details. Also call Pornhub and ask how they were blocking specific states to meet legal requirements.
Tough for the neighbors, but nitpicking "resident" is not a good choice here.
I leave my home computer network open to the public and now suddenly I'm liable to some random jurisdiction around the world because someone in that location decides to call my computer?
China's GFW seems benign in comparison
Cut the ignoramuses from the US internet until they can learn to be decent people. Serves them right, and well, legally.
very incurious/very unhacker
Pornhub and BlueSky have done similar in response to this legislation in Texas. Wikipedia and a few other sites blocked the UK to avoid being burdened by their Safety act. Pretty much every streaming platform implements regional geo blocking for licensing reasons.
I’ll be curious to see how things shake out in the long run given the current political climate.
No? Wikipedia is not blocked in the UK.
Also, for the enforcement agency who is/will be tasked with checking things out here...do they know whether geo-blocking is valid method or not? Its a silly law, don't get me wrong...but if its enforcement validation mechanisms are not up to snuff, i wonder how things will play out - both here in dreamwidth's case and other folks in a similar boat?
It may not be, if the law can be applied to them.
OTOH, may be sufficient to make it illegal to apply the law to them in the first place. US states do not have unlimited jurisdiction to regulate conduct occurring outside of their borders, but they do have more ability to regulate conduct of entities intentionally doing business within their borders.
Reminds me of Silicon Valley. PiperChat has grossly violated COPPA as there was no parental consent form on the app leading to a 21 billion dollar fine: https://www.youtube.com/watch?v=N3zU7sV4bJE
I’m not being glib. Honestly, why can’t I? There’s precedent for saying that’s unauthorized access, so the feds (not the state; “Interstate Commerce Clause” and all that) should prosecute the visitor for violating my ToS.
The laws are written in a way where the responsibility for enforcement falls on the operator of the business. In both cases, the business doesn't actually have to verify anything if they don't want to, but if it's found that they're allowing violations to happen, they will be held legally responsible.
That would allow you, perhaps, to sue people from MS that used your site for violating the ToS (though, "some idiotic courts have ruled" does not mean "the courts which actually create binding precedent over those that would adjudicate your case have ruled...", so, be careful even there.) But that doesn't actually mean that, if someone from MS used your site and you took no further steps to prevent it you would not be liable to the extent that you did not comply with the age verification law.
> There’s precedent for saying that’s unauthorized access, so the feds (not the state; “Interstate Commerce Clause” and all that) should prosecute the visitor for violating my ToS.
Most things in interstate commerce, except where the feds have specifically excluded the states, are both federal and state jurisdiction, but neither the feds nor the state are obligated, even if applicable law exists which allows them to, to prosecute anyone for violating your ToS. You can (civilly) attempt to do so if you are bothered by it.
https://www.wired.com/story/bluesky-goes-dark-in-mississippi...
This is just the start and the trial balloons. The enemy within is a bit nervous about this attack on the most fundamental freedom that the Constitution is protecting, free speech, but they’re also very confident in themselves.
For example, these days in Russia awareness and usage of VPN is well beyond any normal country. With Facebook and IG for example blocked for Meta being officially branded an "extremist organization" (by the way Taliban was taken off that list recently, so what do you guys in Menlo Park are cooking what is worse than Taliban? May be some freedom of speech? :) people in Russia of all strata is still using it, now through VPN, many from mobile devices. The thing of note from USSR/Russia here is that habitual violation of unreasonable laws breeds wide disrespect for the system of law as a whole, and it i very hard to reverse the flow.
It is possible some US States and maybe the UK will end up like China.
it is like age verifying current generic access to the Internet. Sure, we'll come to this too (the anti-utopias aren't fiction, it is future :), yet we still don't verify such a generic access because it isn't the time yet, the society isn't yet totalitarian enough.
As a preview - in Russia (i'm less familiar with China to comment on it) they do already attack VPN by making it illegal to advertise it, something like this.
Dreamwidth has been at the forefront of banning large swaths of the internet. They started doing it years before anyone else. Before the for-profit corporate spidering of HTTP/S content even began causing issues. This is well trod territory and entirely familiar for them and their upstream network provider they like to blame their inability to fix it on.
Please don't comment like this on HN. We need everyone to avoid ideological flamebait and unkind swipes. Please take a moment to read the guidelines and make an effort to observe them in future.
https://news.ycombinator.com/newsguidelines.html
Also "operate in or leave" doesn't make a lick of sense on THE INTERNET